#include "tls_chain.h"
#include "curl_global.h"
#include <curl/curl.h>
#include <limits.h>
#include <stdatomic.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <openssl/asn1.h>
#include <openssl/bio.h>
#include <openssl/bytestring.h>
#include <openssl/err.h>
#include <openssl/nid.h>
#include <openssl/obj.h>
#include <openssl/pem.h>
#include <openssl/pkcs7.h>
#include <openssl/x509.h>

Include dependency graph for tls_chain.c:

Macros
#define	_POSIX_C_SOURCE 200809L

#define	CWIST_AIA_MAX_RESPONSE_BYTES (1024u * 1024u)

#define	CWIST_AIA_MAX_CHAIN_DEPTH 8

#define	CWIST_AIA_CONNECT_TIMEOUT_MS 2000L

#define	CWIST_AIA_TIMEOUT_MS 5000L

Typedefs
typedef struct cwist_cert_fetch_buffer	cwist_cert_fetch_buffer

Functions
unsigned long	cwist_tls_sess_cache_size (void)

int	cwist_tls_autoload_intermediates (SSL_CTX *ssl_ctx)
	Autoload missing intermediate CA certificates into an SSL_CTX chain.

Macro Definition Documentation

◆ _POSIX_C_SOURCE

#define _POSIX_C_SOURCE 200809L

Definition at line 1 of file tls_chain.c.

◆ CWIST_AIA_CONNECT_TIMEOUT_MS

#define CWIST_AIA_CONNECT_TIMEOUT_MS 2000L

Definition at line 40 of file tls_chain.c.

◆ CWIST_AIA_MAX_CHAIN_DEPTH

#define CWIST_AIA_MAX_CHAIN_DEPTH 8

Definition at line 39 of file tls_chain.c.

◆ CWIST_AIA_MAX_RESPONSE_BYTES

#define CWIST_AIA_MAX_RESPONSE_BYTES (1024u * 1024u)

Definition at line 38 of file tls_chain.c.

◆ CWIST_AIA_TIMEOUT_MS

#define CWIST_AIA_TIMEOUT_MS 5000L

Definition at line 41 of file tls_chain.c.

Typedef Documentation

◆ cwist_cert_fetch_buffer

typedef struct cwist_cert_fetch_buffer cwist_cert_fetch_buffer

Function Documentation

◆ cwist_tls_autoload_intermediates()

int cwist_tls_autoload_intermediates ( SSL_CTX * ssl_ctx )

Autoload missing intermediate CA certificates into an SSL_CTX chain.

Starting from the current chain tail, walks up the issuance path using AIA caIssuers URLs until a self-signed (root) certificate is reached, the chain depth limit (CWIST_AIA_MAX_CHAIN_DEPTH) is hit, or no issuer can be fetched. Issuers that would duplicate a certificate already installed are not added.

Parameters

ssl_ctx SSL context whose certificate chain should be completed.

Returns: number of intermediate certificates added (0 if none were needed or found), or -1 on error.

Definition at line 568 of file tls_chain.c.

References cap, and CWIST_AIA_MAX_CHAIN_DEPTH.

◆ cwist_tls_sess_cache_size()

unsigned long cwist_tls_sess_cache_size ( void )

Bounded retention for the BoringSSL server-side session cache.

BoringSSL's implicit cap is 20k entries per SSL_CTX (ssl.h SSL_SESSION_CACHE_MAX_SIZE); nothing in CWIST called SSL_CTX_sess_set_cache_size, so a deployment seeing TLS 1.2 session-ID resumption could accumulate up to that per worker process with no bound it could tune. The knob caps the cache on every server context. Measured session-cache usage under wrk/ab/h2load and openssl s_client TLS 1.2 churn is 0 (TLS 1.3 tickets are stateless and never enter the server cache), so today this is retention hardening, not an RSS win. The cap is consulted on session insert only: zero hot-path impact.

Returns: The validated CWIST_TLS_SESS_CACHE_SIZE env override or 1024; cached after first read. 0 leaves the BoringSSL default uncapped.

Definition at line 537 of file tls_chain.c.

References cap.

Macros

Typedefs

Functions